fix(ci): harden against template injection and credential exposure

[stevebeattie]

Summary

This patch series addresses GitHub Actions security findings from the PSEC-923 sweep of chainguard-dev/actions. Ten commits are included.

Patches

0001 — fix(ci): resolve template injection findings

Fixes template-injection findings in three CI workflow files by moving
${{ context }} expressions into env: variables and referencing them via
$VAR_NAME in run: blocks.

Files changed:

• .github/workflows/test-bump-go-version.yaml — 10 injection points across 5 run: steps
• .github/workflows/test-matrix-extra-inputs.yaml — 1 injection point; the expression was in a single-quoted string, so echo '...' was converted to printf '%s\n' "$MATRIX_JSON" to allow env var expansion; the receiving step was also given id: check-matrix-output and a blank line separator to distinguish it visually from the preceding step's env: block
• .github/workflows/test-setup-kind.yaml — 1 injection point in check domain step

All env: blocks are placed before run:, and all generated shell references use
double-quoted "$VAR_NAME" form.

0002 — fix(ci): resolve template injection findings in setup-* composite actions

Fixes template-injection findings across 13 setup-* composite action definitions.
All ${{ inputs.X }} expressions are moved to step-level env: blocks as
INPUTS_X: ${{ inputs.X }} and referenced as ${INPUTS_X} in shell.

Standard runner env vars ($RUNNER_OS, $RUNNER_ARCH, $GITHUB_TOKEN, etc.) are
used directly without env: entries since the runner sets them unconditionally.

Files changed:

• setup-argo-workflows/action.yaml
• setup-chainguard-terraform/action.yaml
• setup-gcsfuse/action.yaml
• setup-hakn/action.yaml
• setup-k3d/action.yaml
• setup-kind/action.yaml
• setup-knative-eventing/action.yaml
• setup-knative/action.yaml
• setup-melange/action.yaml
• setup-mink/action.yaml
• setup-mirror/action.yaml — jq invocation converted to use --arg instead of
  single-quote-break alternation ('"${VAR}"'); --arg handles values containing
  ", \, or ] safely and avoids quoting complexity
• setup-monitoring/action.yaml
• setup-spdx/action.yaml

0003 — fix(ci): resolve template injection findings in build/utility composite actions

Fixes template-injection findings across 19 build and utility composite action
definitions, using the same env:/INPUTS_* pattern as 0002.

Files changed:

• boilerplate/action.yaml
• eof-newline/action.yaml
• git-tag/action.yml
• gofmt/action.yaml
• goimports/action.yaml
• inky-build-pkg/action.yaml
• k8s-diag/action.yaml
• kind-diag/action.yaml
• matrix-extra-inputs/action.yml
• melange-build-pkg/action.yaml
• melange-keygen/action.yaml
• nodiff/action.yaml
• release-notes/action.yml
• setup-gitsign/action.yml
• setup-terraform-docs/action.yml
• setup-terraform/action.yml
• shellcheck/action.yaml
• terraform-diag/action.yaml
• trailing-space/action.yaml
• wgetsum/action.yaml

0004 — fix(ci): resolve template injection in steps.outputs context

Fixes template-injection findings where ${{ steps.X.outputs.Y }} expressions
appear in run: blocks. These are moved to env: variables using a
STEP_X_Y: ${{ steps.X.outputs.Y }} naming convention.

Files changed:

• bump-go-version-file/action.yml — STEP_BUMP_OLD_VERSION, STEP_BUMP_NEW_VERSION, STEP_CREATE_PR_UPDATE_DIFF

0005 — fix(ci): address github-env findings in composite actions

Fixes github-env findings where user-controlled values are written to $GITHUB_ENV
or $GITHUB_PATH without stripping newlines, enabling potential newline-injection
attacks. Fixes applied: strip newlines with tr -d '\n' before writing to
$GITHUB_ENV; use printf '%s\n' instead of echo for $GITHUB_PATH writes.

Files changed:

• chainguard-install/action.yml
• hugo2confluence/action.yaml
• setup-argo-workflows/action.yaml
• setup-gitsign/action.yml
• setup-kind/action.yaml
• setup-terraform-docs/action.yml

0006 — fix(ci): add persist-credentials: false to checkout steps

Fixes 4 artipacked findings:

• .github/workflows/release.yaml — persist-credentials: false added; git fetch --tags does not need credentials since the repo is public, and subsequent git-tag/goreleaser steps receive the token via their own inputs
• .github/workflows/test-apt-faster.yaml — persist-credentials: false (test workflow, no push ops)
• .github/workflows/test-setup-eksctl.yaml — persist-credentials: false (test workflow, no push ops)
• .github/workflows/test-shellcheck.yaml — persist-credentials: false (test workflow, no push ops)

0007 — fix(ci): add pedantic persona and suppress noisy zizmor rules

• .github/zizmor.yml — appends suppressions for concurrency-limits (15 findings),
  anonymous-definition (9 findings), and undocumented-permissions (1 finding);
  none of these have exploitable security impact
• .github/workflows/zizmor.yaml — adds persona: pedantic to the zizmor-action
  step to ensure template-injection findings at the pedantic threshold are also caught
  in CI

0008 — fix(ci): resolve shellcheck findings in composite action files

Fixes shellcheck findings at --severity=info across 7 composite action definition
files (setup-terraform is handled in 0003 where its env: block was already added):

• bump-go-version-file: quote $GITHUB_STEP_SUMMARY in all 13 redirect targets (SC2086)
• chainguard-install: add # shellcheck disable=SC2086 comment for intentional word splitting when expanding $PACKAGES (a space-separated package list passed to run_apk)
• git-tag: quote inner expansion in ${latest_tag#"$git_tag_prefix"} parameter substitution (SC2295)
• matrix-extra-inputs: quote $k and $v in jq argument construction; quote $GITHUB_OUTPUT redirect (SC2086)
• release-notes: split export VAR=$(...) into separate declaration and export for ORG and START_SHA (SC2155); quote $LAST_BRANCH and $BRANCH in git merge-base call (SC2086); quote $GITHUB_OUTPUT redirect
• setup-gitsign: quote $HOME path and $1 argument in shaprog function (SC2086); quote RHS of != comparison in [[ to prevent glob matching (SC2053); quote $GITHUB_PATH redirect
• setup-terraform-docs: quote $HOME path and $1 argument in shaprog function (SC2086); quote RHS of != comparison (SC2053); quote $GITHUB_PATH redirect

0009 — fix(ci): resolve shellcheck findings in remaining composite action files

Fixes shellcheck findings at --severity=info across 21 composite action files
touched by the template-injection and github-env patches but not yet addressed:

• SC2164 (cd/pushd without || exit): boilerplate, gofmt, goimports, hugo2confluence, melange-build-pkg
• SC2242 (exit -1 invalid exit code): setup-hakn, setup-knative, setup-melange
• SC2259 (redirect overrides piped input in cat | cmd <<EOF): setup-knative, setup-knative-eventing
• SC2166 (compound -a in [ ]): setup-knative
• SC2155 (export VAR=$(...) masks return value): setup-hakn, setup-knative, terraform-diag
• SC1083 (literal {} in jsonpath expression): setup-hakn, setup-knative
• SC2068 (unquoted array expansion ${arr[@]}): hugo2confluence
• SC2034 (unused variable): setup-gcsfuse
• SC2086 (unquoted variables): eof-newline, gofmt, goimports, hugo2confluence, k8s-diag, kind-diag, melange-build-pkg, nodiff, setup-argo-workflows, setup-chainguard-terraform, setup-gcsfuse, setup-hakn, setup-k3d, setup-kind, setup-knative, setup-knative-eventing, setup-melange, shellcheck, wgetsum
• SC2046 (unquoted $(find ...) for intentional word-splitting): gofmt, goimports; suppressed with explanation comment
• SC2154 (variable set via env: block not visible to shellcheck): shellcheck/action.yaml; suppressed with explanation comment

0010 — fix(ci): resolve actionlint findings in workflow files

• .github/actionlint.yaml (new) — suppresses a false positive in test-shellcheck.yaml: actionlint cannot parse type: boolean in composite action inputs, but this field is valid per the GitHub Actions schema
• test-apt-faster.yaml — add # shellcheck disable=SC2317 before stderr() helper function, consistent with the existing suppressions on the other helpers in that script
• test-bump-go-version.yaml — fix SC2002 (useless cat): cat file | tr → tr < file (two instances)

Suppressions Not Applied

• dependabot-cooldown — out of scope for this campaign (config-level policy finding,
  not a workflow security issue; existing zizmor.yml already adjusts the cooldown to 3 days)

References

• Campaign: PSEC-923
• zizmor version: 1.24.1
• Sweep date: 2026-05-02